Skip to content
Fencer Vulns
critical 9.8

CVE-2007-4559 in the critical feed json

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remo…

published 2007-08-28 19 y ago modified 2026-06-16 4 mo ago also BIT-python-2007-4559 , BIT-python-min-2007-4559 , EUVD-2007-4541

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
27.1%
EPSS 27.1% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

Patch / fix

  • bitnami python 3.6.16, 3.8.17, 3.9.17, 3.10.12, 3.11.4
  • bitnami python-min 3.6.16, 3.8.17, 3.9.17, 3.10.12, 3.11.4
  • python python 3.6.16, 3.8.17, 3.9.17, 3.10.12, 3.11.4
  • python3.10 Ubuntu 22.04 LTS 3.10.12-1~22.04.2

ubuntu advisories UBUNTU-CVE-2007-4559

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rh-python38-python RHEL 3 SOFTWARE_COLLECTIONS 3.8.18-2.el7
  • rh-python38-python-pip RHEL 3 SOFTWARE_COLLECTIONS 19.3.1-4.el7
  • rh-python38-python-idle RHEL 3 SOFTWARE_COLLECTIONS 3.8.18-2.el7
  • rh-python38-python-libs RHEL 3 SOFTWARE_COLLECTIONS 3.8.18-2.el7
  • rh-python38-python-test RHEL 3 SOFTWARE_COLLECTIONS 3.8.18-2.el7
  • rh-python38-python-wheel RHEL 3 SOFTWARE_COLLECTIONS 0.33.6-9.el7
  • rh-python38-python-tkinter RHEL 3 SOFTWARE_COLLECTIONS 3.8.18-2.el7
  • rh-python38-python-requests RHEL 3 SOFTWARE_COLLECTIONS 2.22.0-11.el7

red hat advisories RHSA-2023:6793RHSA-2024:0430RHSA-2023:7024RHSA-2023:6494RHSA-2023:7034RHSA-2023:7050

  • python39 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +7 more 3.9.17-150300.4.30.1
  • python39-core SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +7 more 3.9.17-150300.4.30.1
  • python39-documentation openSUSE Leap 15.5, openSUSE Leap 15.4 3.9.17-150300.4.30.1
  • python311 SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 3.11.4-150400.9.15.1
  • python311-core SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 3.11.4-150400.9.15.3
  • python311-documentation SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 3.11.4-150400.9.15.2
  • python310 SLE Module for Python 3 15 SP4, openSUSE Leap 15.5, openSUSE Leap 15.4 3.10.12-150400.4.30.1
  • python310-core SLE Module for Python 3 15 SP4, openSUSE Leap 15.5, openSUSE Leap 15.4 3.10.12-150400.4.30.1

suse advisories SUSE-SU-2026:0210-1SUSE-SU-2023:2957-1SUSE-SU-2023:2937-1SUSE-SU-2023:2884-1SUSE-SU-2023:2778-1SUSE-SU-2023:2641-1

  • python-pywayland openSUSE Tumbleweed 0.4.17-3.5
  • python-pywayland openSUSE Tumbleweed 0.4.15-1.1
  • python39 openSUSE Tumbleweed 3.9.16-7.1
  • python310 openSUSE Tumbleweed 3.10.11-1.1
  • python311 openSUSE Tumbleweed 3.11.3-1.1
  • python38 openSUSE Tumbleweed 3.8.16-7.1
  • samba openSUSE Tumbleweed 4.18.5+git.313.c8e274c7852-1.1

opensuse advisories openSUSE-SU-2025:15104-1openSUSE-SU-2024:12684-1openSUSE-SU-2024:12947-1openSUSE-SU-2024:12964-1openSUSE-SU-2024:12976-1openSUSE-SU-2024:12977-1

  • python3.11-pip AlmaLinux 8 22.3.1-4.el8
  • python3.11-pip-wheel AlmaLinux 8 22.3.1-4.el8
  • python3.11 AlmaLinux 8 3.11.5-1.el8_9
  • python3.11-idle AlmaLinux 8 3.11.5-1.el8_9
  • python3.11-libs AlmaLinux 8 3.11.5-1.el8_9
  • python3.11-test AlmaLinux 8 3.11.5-1.el8_9
  • python3.11-tkinter AlmaLinux 8 3.11.5-1.el8_9
  • python3.11-rpm-macros AlmaLinux 8 3.11.5-1.el8_9

almalinux advisories ALSA-2023:6914ALSA-2023:7024ALSA-2023:7034ALSA-2023:7050ALSA-2023:7151ALSA-2023:7176

  • numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1582+bc278001
  • numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1860+afcc1c71
  • scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1860+afcc1c71
  • scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1582+bc278001
  • Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1860+afcc1c71
  • Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1582+bc278001
  • pytest Rocky Linux 8 6.0.2-2.module+el8.10.0+1860+afcc1c71
  • pytest Rocky Linux 8 6.0.2-2.module+el8.10.0+1582+bc278001

rocky linux advisories RLSA-2023:7034RLSA-2023:7050

  • python2 CBL-Mariner 2.0 2.7.18-8
  • python3 CBL-Mariner 2.0 3.9.19-1

azure linux advisories AZL-6822AZL-6828

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2007-4559 updated cvss 5.5

python: tarfile module directory traversal

  • Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, python3, tkinter, python-libs, python-test, python-tools, +4 more Red Hat Enterprise Linux 8 python2, python2-libs, python2-test, python2-tools, python2-tkinter
    affected: workaround, no fix planned “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.”
  • Red Hat CodeReady Linux Builder (v. 8) python3.11 3.11.5-1.el8_9, python3.11-idle 3.11.5-1.el8_9, python3.11-test 3.11.5-1.el8_9, python3.11-tkinter 3.11.5-1.el8_9, pytest 4.6.6-3.module+el8.9.0+19592+4b459c9b, pytest 6.0.2-2.module+el8.9.0+19644+d68f775d, +38 more
    fixed: vendor fix “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.” RHSA-2023:7050
  • Red Hat CodeReady Linux Builder (v. 9) python3 3.9.18-1.el9_3, python3.11 3.11.5-1.el9_3, python3-idle 3.9.18-1.el9_3, python3-test 3.9.18-1.el9_3, python3-tkinter 3.9.18-1.el9_3, python3.11-idle 3.11.5-1.el9_3, +2 more
    fixed: vendor fix “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.” RHSA-2023:6659
  • Red Hat Enterprise Linux AppStream (v. 8) python3-pip 9.0.3-23.el8, python3.11 3.11.5-1.el8_9, python3-idle 3.6.8-56.el8_9, python3-test 3.6.8-56.el8_9, python3.11-pip 22.3.1-4.el8, platform-python 3.6.8-56.el8_9, +125 more
    fixed: vendor fix “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.” RHSA-2023:7050
  • Red Hat Enterprise Linux AppStream (v. 9) python3-pip 21.2.3-7.el9, python3.11 3.11.5-1.el9_3, python3.11-pip 22.3.1-4.el9, python3-tkinter 3.9.18-1.el9_3, python3.11-libs 3.11.5-1.el9_3, python3.11-pip-wheel 22.3.1-4.el9, +2 more
    fixed: vendor fix “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.” RHSA-2023:6659
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) python3-pip 9.0.3-22.1.el8_6, python3-idle 3.6.8-47.el8_6.4, python3-test 3.6.8-47.el8_6.4, platform-python 3.6.8-47.el8_6.4, python3-tkinter 3.6.8-47.el8_6.4
    fixed: vendor fix “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.” RHSA-2024:0430
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) python3-pip 9.0.3-22.1.el8_8
    fixed: vendor fix “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.” RHSA-2024:0587
  • Red Hat Enterprise Linux BaseOS (v. 8) python3 3.6.8-56.el8_9, python-pip 9.0.3-23.el8, python3-libs 3.6.8-56.el8_9, python3-test 3.6.8-56.el8_9, platform-python 3.6.8-56.el8_9, python3-pip-wheel 9.0.3-23.el8, +1 more
    fixed: vendor fix “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.” RHSA-2023:7151
show 5 more
  • Red Hat Enterprise Linux BaseOS (v. 9) python3 3.9.18-1.el9_3, python-pip 21.2.3-7.el9, python3.9 3.9.18-1.el9_3, python3-libs 3.9.18-1.el9_3, python3-pip-wheel 21.2.3-7.el9
    fixed: vendor fix “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.” RHSA-2023:6659
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) python3 3.6.8-47.el8_6.4, python-pip 9.0.3-22.1.el8_6, python3-libs 3.6.8-47.el8_6.4, python3-test 3.6.8-47.el8_6.4, platform-python 3.6.8-47.el8_6.4, python3-pip-wheel 9.0.3-22.1.el8_6, +1 more
    fixed: vendor fix “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.” RHSA-2024:0430
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) python-pip 9.0.3-22.1.el8_8, python3-pip-wheel 9.0.3-22.1.el8_8, platform-python-pip 9.0.3-22.1.el8_8
    fixed: vendor fix “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.” RHSA-2024:0587
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python 3.8.18-2.el7, rh-python38-python-pip 19.3.1-4.el7, rh-python38-python-idle 3.8.18-2.el7, rh-python38-python-libs 3.8.18-2.el7, rh-python38-python-test 3.8.18-2.el7, rh-python38-python-tkinter 3.8.18-2.el7, +3 more Red Hat Software Collections for RHEL(v. 7) rh-python38-python 3.8.18-2.el7, rh-python38-python-pip 19.3.1-4.el7, rh-python38-python-idle 3.8.18-2.el7, rh-python38-python-libs 3.8.18-2.el7, rh-python38-python-test 3.8.18-2.el7, rh-python38-python-tkinter 3.8.18-2.el7, +3 more
    fixed: vendor fix “Do not extract archives from untrusted sources with the Python tarfile module. Users of the module should add sanity checks when calling the tarfile.extract or tarfile.extractall functions.” RHSA-2023:6793
  • Red Hat Enterprise Linux 8 scipy, python36, python-nose, python-wheel, python3-bson, python3-nose, +19 more Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python-wheel 0.33.6-9.el7, rh-python38-python-cryptography 2.8-6.el7, rh-python38-python-requests 2.22.0-11.el7, rh-python38-python-setuptools 41.6.0-8.el7, rh-python38-python-wheel-wheel 0.33.6-9.el7, rh-python38-python-setuptools-wheel 41.6.0-8.el7 Red Hat Software Collections for RHEL(v. 7) rh-python38-python-wheel 0.33.6-9.el7, rh-python38-python-cryptography 2.8-6.el7, rh-python38-python-requests 2.22.0-11.el7, rh-python38-python-setuptools 41.6.0-8.el7, rh-python38-python-wheel-wheel 0.33.6-9.el7, rh-python38-python-setuptools-wheel 41.6.0-8.el7
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

27.10% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • mail.python.org http://mail.python.org/pipermail/python-dev/2007-August/074292.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami python
<3.6.16
>=3.7.0, <3.8.17
>=3.9.0, <3.9.17
>=3.10.0, <3.10.12
>=3.11.0, <3.11.4
3.6.16
3.8.17
3.9.17
3.10.12
3.11.4
bitnami python-min
<3.6.16
>=3.7.0, <3.8.17
>=3.9.0, <3.9.17
>=3.10.0, <3.10.12
>=3.11.0, <3.11.4
3.6.16
3.8.17
3.9.17
3.10.12
3.11.4

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.